Scheduled Task Creation via PowerShell Schedule.Service COM Object

MalGamy (Nextron System)

Detects PowerShell execution using the Schedule.Service COM object to create scheduled tasks. There are straightforward methods to create scheduled tasks using built-in Windows tools such as schtasks.exe or PowerShell cmdlets like New-ScheduledTask. However, threat actors may leverage alternatice method such as the Schedule.Service COM object to create scheduled tasks to bypass detection.

2025-10-21 00:00:00

None

915af8a8-7db6-4f4c-bc94-0c2ea8353416

attack.execution attack.t1059.001 attack.t1559.001 attack.persistence attack.t1053.005 attack.privilege-escalation

Nextron Sigma feed only (private)